[go: up one dir, main page]

US10409976B2 - System and method for PIN entry on mobile devices - Google Patents

System and method for PIN entry on mobile devices Download PDF

Info

Publication number
US10409976B2
US10409976B2 US16/165,226 US201816165226A US10409976B2 US 10409976 B2 US10409976 B2 US 10409976B2 US 201816165226 A US201816165226 A US 201816165226A US 10409976 B2 US10409976 B2 US 10409976B2
Authority
US
United States
Prior art keywords
grid
mobile computing
display
computing device
pin
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
US16/165,226
Other versions
US20190050553A1 (en
Inventor
Chi Wah Lo
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Stripe Inc
Original Assignee
BBPOS Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by BBPOS Ltd filed Critical BBPOS Ltd
Priority to US16/165,226 priority Critical patent/US10409976B2/en
Assigned to BBPOS Limited reassignment BBPOS Limited ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: LO, CHI WAH
Publication of US20190050553A1 publication Critical patent/US20190050553A1/en
Priority to US16/440,661 priority patent/US10867027B2/en
Application granted granted Critical
Publication of US10409976B2 publication Critical patent/US10409976B2/en
Priority to US17/113,683 priority patent/US11580208B2/en
Assigned to Stripe, Inc. reassignment Stripe, Inc. ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: BBPOS Limited
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G06F21/34—User authentication involving the use of external additional devices, e.g. dongles or smart cards
    • G06F21/35—User authentication involving the use of external additional devices, e.g. dongles or smart cards communicating wirelessly
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/71—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information
    • G06F21/72—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information in cryptographic circuits
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F3/00—Input arrangements for transferring data to be processed into a form capable of being handled by the computer; Output arrangements for transferring data from processing unit to output unit, e.g. interface arrangements
    • G06F3/01—Input arrangements or combined input and output arrangements for interaction between user and computer
    • G06F3/011—Arrangements for interaction with the human body, e.g. for user immersion in virtual reality
    • G06F3/013—Eye tracking input arrangements
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F3/00—Input arrangements for transferring data to be processed into a form capable of being handled by the computer; Output arrangements for transferring data from processing unit to output unit, e.g. interface arrangements
    • G06F3/01—Input arrangements or combined input and output arrangements for interaction between user and computer
    • G06F3/02—Input arrangements using manually operated switches, e.g. using keyboards or dials
    • G06F3/023—Arrangements for converting discrete items of information into a coded form, e.g. arrangements for interpreting keyboard generated codes as alphanumeric codes, operand codes or instruction codes
    • G06F3/0233—Character input methods
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F3/00—Input arrangements for transferring data to be processed into a form capable of being handled by the computer; Output arrangements for transferring data from processing unit to output unit, e.g. interface arrangements
    • G06F3/01—Input arrangements or combined input and output arrangements for interaction between user and computer
    • G06F3/03—Arrangements for converting the position or the displacement of a member into a coded form
    • G06F3/033—Pointing devices displaced or positioned by the user, e.g. mice, trackballs, pens or joysticks; Accessories therefor
    • G06F3/038—Control and interface arrangements therefor, e.g. drivers or device-embedded control circuitry
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F3/00—Input arrangements for transferring data to be processed into a form capable of being handled by the computer; Output arrangements for transferring data from processing unit to output unit, e.g. interface arrangements
    • G06F3/01—Input arrangements or combined input and output arrangements for interaction between user and computer
    • G06F3/048—Interaction techniques based on graphical user interfaces [GUI]
    • G06F3/0487—Interaction techniques based on graphical user interfaces [GUI] using specific features provided by the input device, e.g. functions controlled by the rotation of a mouse with dual sensing arrangements, or of the nature of the input device, e.g. tap gestures based on pressure sensed by a digitiser
    • G06F3/0488—Interaction techniques based on graphical user interfaces [GUI] using specific features provided by the input device, e.g. functions controlled by the rotation of a mouse with dual sensing arrangements, or of the nature of the input device, e.g. tap gestures based on pressure sensed by a digitiser using a touch-screen or digitiser, e.g. input of commands through traced gestures
    • G06F3/04886—Interaction techniques based on graphical user interfaces [GUI] using specific features provided by the input device, e.g. functions controlled by the rotation of a mouse with dual sensing arrangements, or of the nature of the input device, e.g. tap gestures based on pressure sensed by a digitiser using a touch-screen or digitiser, e.g. input of commands through traced gestures by partitioning the display area of the touch-screen or the surface of the digitising tablet into independently controllable areas, e.g. virtual keyboards or menus
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/12—Detection or prevention of fraud
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2203/00—Indexing scheme relating to G06F3/00 - G06F3/048
    • G06F2203/038—Indexing scheme relating to G06F3/038
    • G06F2203/0383—Remote input, i.e. interface arrangements in which the signals generated by a pointing device are transmitted to a PC at a remote location, e.g. to a PC in a LAN
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/69—Identity-dependent
    • H04W12/77—Graphical identity

Definitions

  • the present invention relates to a system and a method for PIN entry on mobile computing devices.
  • Portable personal computing devices such as smart phones, Personal Digital Assistant, portable computers, tablet computers and audio devices such as digital music players have become ubiquitous in recent years. This opens up the possibility of many different mobile applications such as mobile banking, mobile payment, mobile commerce, and person-to-person money transfer, among others.
  • PIN Personal Identification Number
  • the PIN is a number known only to that person and not to anyone else.
  • PIN Personal Identification Number
  • a combination of “something you know”, “something you have” and “something you are” is used.
  • “Something you have” can be a digital token, a card.
  • “Something you are” is some biometrics like facial characteristics, fingerprints, voice, iris or retina scan or even DNA.
  • PIN, password and personal information such as date of birth fall into the category of “something you know”.
  • PIN is the most sensitive piece on information used for authentication.
  • PCI Payment Card Industry
  • PEDs PIN-entry devices
  • the invention provides a secure and convenient way for PIN entry on a mobile computing device with the use of a peripheral device.
  • the invention features a system for entering a secure Personal Identification Number (PIN) into a mobile computing device.
  • the system includes a mobile computing device and a peripheral device.
  • the mobile computing device includes a mobile application and a display and the mobile application is configured to run on the mobile computing device and to display a grid on the mobile computing device display.
  • the peripheral device includes a display and an encryption engine, and the peripheral device display is configured to display a grid corresponding to the grid displayed on the mobile computing device display.
  • the peripheral device is connected to the mobile computing device via a data communication link.
  • Positional inputs on the mobile computing device grid are configured to be sent to the peripheral device and the peripheral device is configured to decode the positional inputs into PIN digits and to generate an encrypted PIN and then to send the encrypted PIN back to the mobile computing device.
  • Implementations of this aspect of the invention may include one or more of the following features.
  • the mobile application is configured to display the grid on the mobile computing device without showing any digits.
  • the grid displayed on the peripheral device includes a randomized grid of digits.
  • the grid displayed on the peripheral device is configured to randomize the position of each digit on the grid after each positional input.
  • the encryption engine in the peripheral device is configured to store one or more cryptographic keys and the one or more cryptographic keys are used for encrypting PIN and/or data.
  • the encryption engine in the peripheral device is configured to perform cryptographic operations comprising encryption, decryption, digital signature, hashing, and random number generation.
  • the data communication link comprises a wired data communication link and the wired data communication link comprises one of USB, Firewire, RS232 or audio jack interface.
  • the data communication link comprises a wireless data communication link and the wireless data communication link comprises one of WiFi, Bluetooth, Infrared, or NFC interface.
  • the peripheral device comprises one of magnetic card reader, EMV card reader, NFC reader, keypad, or biometrics readers.
  • the mobile computing device comprises one of mobile phones, personal digital assistants (PDAs), netbooks, tablet computers, notebook computers, electronic readers, digital music players, digital video players, or game consoles. Positional inputs on the mobile computing device are provided via one of touch screens, mouse clicks, track ball, or eyeball movement tracking devices.
  • the invention features a method for entering a secure Personal Identification Number (PIN) into a mobile computing device including the following.
  • Providing a mobile computing device comprising a mobile application and a display.
  • the mobile application is configured to run on the mobile computing device and to display a grid on the mobile computing device display.
  • providing a peripheral device comprising a display and an encryption engine.
  • the peripheral device display is configured to display a grid corresponding to the grid displayed on the mobile computing device display.
  • the peripheral device is connected to the mobile computing device via a data communication lime Next, providing positional inputs on the mobile computing device and wherein the positional inputs are configured to be sent to the peripheral device and the peripheral device is configured to decode the positional inputs into PIN digits and to generate an encrypted PIN and then to send the encrypted PIN back to the mobile computing device.
  • FIG. 1 shows a mobile computing device and a peripheral device connected together via the wired or wireless data communication link
  • FIG. 2 shows a randomized key grid display on the peripheral device and a without the digits shown on the mobile computing device
  • FIG. 3 illustrates the sequence of positions pressed on the mobile communication device grid to enter the PIN sequence “1243” using the randomized grid pattern in the peripheral device grid.
  • the present invention describes a system and the method for entering a PIN on mobile computing devices in a secure and convenient manner.
  • a representation of a digits grid is shown on a peripheral device and the actual input captures are done on a separate mobile computing device.
  • Positional information captured on the mobile computing device is mapped back into its PIN representation on the peripheral device. This separation adds another layer of security to the PIN input process that can help reduce the complexity of the design of both the mobile phone application and the peripheral device.
  • the data communication link 300 may be a wired connection or a wireless connection.
  • the wired connection may be implemented via one of USB, Firewire, RS232 or audio jack interface.
  • the wireless connection may be implemented via one of WiFi, Bluetooth, Infrared, NFC or other forms of data coupling.
  • the peripheral device 200 displays a randomized grid of digits 201 and keys 202 , as shown in FIG. 2 .
  • a software application 110 on the mobile computing device 100 displays a corresponding grid 101 of the same arrangement without the digits shown on the key positions 102 .
  • the PIN is entered in the mobile computing device 100 by pressing the corresponding key positions 102 on the grid 101 shown on the mobile computing device 100 relative to the key positions 202 on the grid 201 shown on the peripheral device 200 .
  • the position is sent to the peripheral device 200 and from the relative position of the key press, the PIN digits intended to be entered are computed by the peripheral device 200 , processed and sent back to the mobile computing device 100 in an encrypted or otherwise cryptographically secure format.
  • the format is an Encrypted PIN Block (EPB) format.
  • EPB can be further transmitted to other parties such as a payment processor gateway for further processing.
  • the peripheral device 200 is used to generate and display a randomized grid of digits on its display 201 .
  • the display 201 may be one of LCD displays, LED displays, plasma or seven segment displays.
  • an encryption engine 210 capable of decoding the inputs from the mobile application 110 and encode the PIN into a secure format such as an Encrypted PIN Block (EPB).
  • EPB Encrypted PIN Block
  • Mobile application 110 runs on the mobile computing device 100 and communicates with the peripheral device 200 through the data communication link 300 .
  • the mobile application 110 tells the peripheral device 200 to generate and display the randomized number grid 201 , as shown in FIG. 2 .
  • the mobile phone 100 displays a corresponding grid 101 without the numbers.
  • Function keys 103 such as “Cancel”, “Back”, “OK” and “Enter” are also shown on the mobile phone 100 .
  • a position pointing device or methods When a user wants to enter a number, the corresponding position on grid 101 displayed by the mobile phone application 110 is pressed, touched or otherwise indicated by a position pointing device or methods.
  • This position pointing device or method may be one of touch screens, mouse click, track ball, or eyeball movement tracking devices.
  • pressing the top-right square on the grid 101 on the mobile phone 100 means the user intends to enter the digit “6”, as shown in FIG. 2 .
  • FIG. 3 illustrates the user actions to enter the PIN sequence “1243”.
  • the four positions corresponding to the “1”, “2”, “4” and “3” shown on the peripheral device 200 are pressed sequentially.
  • the mobile application 110 sends the position data to the peripheral device 200 and the peripheral device 200 uses the positional information to decode which digit is inputted.
  • the “OK” key is pressed and the mobile application 110 tells the peripheral device 200 that all digits have been entered.
  • the peripheral device 200 then processes and encrypts the input positions and sends back an encrypted output of the PIN.
  • the randomized grid 201 does not shuffle after each key press. However, in other examples grid 201 randomizes the position of the displayed digits after every keypress.
  • PDAs personal digital assistants
  • netbooks tablet computers
  • notebook computers electronic readers
  • digital music players digital video players
  • game consoles among others.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • General Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • Computer Security & Cryptography (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Hardware Design (AREA)
  • Human Computer Interaction (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Software Systems (AREA)
  • Signal Processing (AREA)
  • Mathematical Physics (AREA)
  • Telephone Function (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

A system for entering a secure Personal Identification Number (PIN) into a mobile computing device includes a mobile computing device and a peripheral device that are connected via a data communication link. The mobile computing device includes a mobile application and a display and the mobile application runs on the mobile computing device and displays a grid on the mobile computing device display. The peripheral device includes a display and an encryption engine, and the peripheral device display displays a grid corresponding to the grid displayed on the mobile computing device display. Positional inputs on the mobile computing device grid are sent to the peripheral device and the peripheral device decodes the positional inputs into PIN digits and generates an encrypted PIN and then sends the encrypted PIN back to the mobile computing device.

Description

CROSS-REFERENCE TO RELATED APPLICATIONS
This application is a continuation of U.S. patent application Ser. No. 14/100,076, filed Dec. 9, 2013, and entitled SYSTEM AND METHOD FOR PIN ENTRY ON MOBILE DEVICES, which claims priority to U.S. Provisional Application No. 61/736,116, filed Dec. 12, 2012, and entitled SYSTEM AND METHOD FOR PIN ENTRY ON MOBILE DEVICES. The contents of application Ser. No. 14/100,076 and 61/736,116 are incorporated by reference herein in their entirety.
TECHNICAL FIELD
The present invention relates to a system and a method for PIN entry on mobile computing devices.
BACKGROUND
Portable personal computing devices such as smart phones, Personal Digital Assistant, portable computers, tablet computers and audio devices such as digital music players have become ubiquitous in recent years. This opens up the possibility of many different mobile applications such as mobile banking, mobile payment, mobile commerce, and person-to-person money transfer, among others.
One of most important aspects of these applications is the authentication of the user and verification of the identity. In many systems, the authentication is done by using a 4 to 12 digits number called a Personal Identification Number (PIN). The PIN is a number known only to that person and not to anyone else. In multiple factor authentication systems, a combination of “something you know”, “something you have” and “something you are” is used. “Something you have” can be a digital token, a card. “Something you are” is some biometrics like facial characteristics, fingerprints, voice, iris or retina scan or even DNA. PIN, password and personal information such as date of birth fall into the category of “something you know”.
For payment cards, PIN is the most sensitive piece on information used for authentication. There are Payment Card Industry (PCI) regulations or other industrial standards that govern how the PIN should be handled by a terminal that accepts a PIN. In the past, PINs are entered by specially designed PIN-entry devices (PEDs). These PIN entry devices are tamper-resistant, and because of the stringent security requirements, are usually very expensive.
Accepting PIN entry by using software running on mobile devices and by using the keys or touch screens on the mobile devices are inherently insecure because of malwares, Trojan horses or hacked operating systems. It is possible that keyloggers and screen capturers can capture the user input and then send it to hackers. One of the challenges in the design of a mobile terminal is how to allow a mobile phone to accept a PIN securely. Therefore, there is a need for a system and a method for secure and yet convenient PIN entry.
SUMMARY
The invention provides a secure and convenient way for PIN entry on a mobile computing device with the use of a peripheral device.
In general, in one aspect, the invention features a system for entering a secure Personal Identification Number (PIN) into a mobile computing device. The system includes a mobile computing device and a peripheral device. The mobile computing device includes a mobile application and a display and the mobile application is configured to run on the mobile computing device and to display a grid on the mobile computing device display. The peripheral device includes a display and an encryption engine, and the peripheral device display is configured to display a grid corresponding to the grid displayed on the mobile computing device display. The peripheral device is connected to the mobile computing device via a data communication link. Positional inputs on the mobile computing device grid are configured to be sent to the peripheral device and the peripheral device is configured to decode the positional inputs into PIN digits and to generate an encrypted PIN and then to send the encrypted PIN back to the mobile computing device.
Implementations of this aspect of the invention may include one or more of the following features. The mobile application is configured to display the grid on the mobile computing device without showing any digits. The grid displayed on the peripheral device includes a randomized grid of digits. The grid displayed on the peripheral device is configured to randomize the position of each digit on the grid after each positional input. The encryption engine in the peripheral device is configured to store one or more cryptographic keys and the one or more cryptographic keys are used for encrypting PIN and/or data. The encryption engine in the peripheral device is configured to perform cryptographic operations comprising encryption, decryption, digital signature, hashing, and random number generation. The data communication link comprises a wired data communication link and the wired data communication link comprises one of USB, Firewire, RS232 or audio jack interface. The data communication link comprises a wireless data communication link and the wireless data communication link comprises one of WiFi, Bluetooth, Infrared, or NFC interface. The peripheral device comprises one of magnetic card reader, EMV card reader, NFC reader, keypad, or biometrics readers. The mobile computing device comprises one of mobile phones, personal digital assistants (PDAs), netbooks, tablet computers, notebook computers, electronic readers, digital music players, digital video players, or game consoles. Positional inputs on the mobile computing device are provided via one of touch screens, mouse clicks, track ball, or eyeball movement tracking devices.
In general, in one aspect, the invention features a method for entering a secure Personal Identification Number (PIN) into a mobile computing device including the following. Providing a mobile computing device comprising a mobile application and a display. The mobile application is configured to run on the mobile computing device and to display a grid on the mobile computing device display. Next, providing a peripheral device comprising a display and an encryption engine. The peripheral device display is configured to display a grid corresponding to the grid displayed on the mobile computing device display. The peripheral device is connected to the mobile computing device via a data communication lime Next, providing positional inputs on the mobile computing device and wherein the positional inputs are configured to be sent to the peripheral device and the peripheral device is configured to decode the positional inputs into PIN digits and to generate an encrypted PIN and then to send the encrypted PIN back to the mobile computing device.
The details of one or more embodiments of the invention are set forth in the accompanying drawings and description bellow. Other features, objects and advantages of the invention will be apparent from the following description of the preferred embodiments, the drawings and from the claims.
BRIEF DESCRIPTION OF THE DRAWINGS
FIG. 1 shows a mobile computing device and a peripheral device connected together via the wired or wireless data communication link;
FIG. 2 shows a randomized key grid display on the peripheral device and a without the digits shown on the mobile computing device; and
FIG. 3 illustrates the sequence of positions pressed on the mobile communication device grid to enter the PIN sequence “1243” using the randomized grid pattern in the peripheral device grid.
 DETAILED DESCRIPTION
The present invention describes a system and the method for entering a PIN on mobile computing devices in a secure and convenient manner. A representation of a digits grid is shown on a peripheral device and the actual input captures are done on a separate mobile computing device. Positional information captured on the mobile computing device is mapped back into its PIN representation on the peripheral device. This separation adds another layer of security to the PIN input process that can help reduce the complexity of the design of both the mobile phone application and the peripheral device.
Referring to FIG. 1, a peripheral device 200 and a mobile computing device 110 are connected together through a data communication link 300. The data communication link 300 may be a wired connection or a wireless connection. The wired connection may be implemented via one of USB, Firewire, RS232 or audio jack interface. The wireless connection may be implemented via one of WiFi, Bluetooth, Infrared, NFC or other forms of data coupling.
When PIN entry is required, the peripheral device 200 displays a randomized grid of digits 201 and keys 202, as shown in FIG. 2. A software application 110 on the mobile computing device 100 displays a corresponding grid 101 of the same arrangement without the digits shown on the key positions 102. The PIN is entered in the mobile computing device 100 by pressing the corresponding key positions 102 on the grid 101 shown on the mobile computing device 100 relative to the key positions 202 on the grid 201 shown on the peripheral device 200. After each key press on the mobile computing device grid 101, the position is sent to the peripheral device 200 and from the relative position of the key press, the PIN digits intended to be entered are computed by the peripheral device 200, processed and sent back to the mobile computing device 100 in an encrypted or otherwise cryptographically secure format. In one example, the format is an Encrypted PIN Block (EPB) format. The EPB can be further transmitted to other parties such as a payment processor gateway for further processing.
The peripheral device 200 is used to generate and display a randomized grid of digits on its display 201. The display 201 may be one of LCD displays, LED displays, plasma or seven segment displays. In the peripheral device 200, there is an encryption engine 210 capable of decoding the inputs from the mobile application 110 and encode the PIN into a secure format such as an Encrypted PIN Block (EPB).
Mobile application 110 runs on the mobile computing device 100 and communicates with the peripheral device 200 through the data communication link 300. When PIN entry is required, the mobile application 110 tells the peripheral device 200 to generate and display the randomized number grid 201, as shown in FIG. 2. The mobile phone 100 displays a corresponding grid 101 without the numbers. Function keys 103, such as “Cancel”, “Back”, “OK” and “Enter” are also shown on the mobile phone 100.
When a user wants to enter a number, the corresponding position on grid 101 displayed by the mobile phone application 110 is pressed, touched or otherwise indicated by a position pointing device or methods. This position pointing device or method may be one of touch screens, mouse click, track ball, or eyeball movement tracking devices. In one example, pressing the top-right square on the grid 101 on the mobile phone 100 means the user intends to enter the digit “6”, as shown in FIG. 2.
There are no numbers shown on the mobile phone grid display 101 and the mobile phone application 110 has no way of knowing what positions correspond to which numbers. In this way, even if the mobile phone 100 is infected with malware such as keyloggers and screen capturers, it will be impossible for the malware to recover the PIN entered.
FIG. 3 illustrates the user actions to enter the PIN sequence “1243”. The four positions corresponding to the “1”, “2”, “4” and “3” shown on the peripheral device 200 are pressed sequentially. After each key press, the mobile application 110 sends the position data to the peripheral device 200 and the peripheral device 200 uses the positional information to decode which digit is inputted. After the four PIN digits are entered, the “OK” key is pressed and the mobile application 110 tells the peripheral device 200 that all digits have been entered. The peripheral device 200 then processes and encrypts the input positions and sends back an encrypted output of the PIN.
In this example, the randomized grid 201 does not shuffle after each key press. However, in other examples grid 201 randomizes the position of the displayed digits after every keypress.
It is understood that the invention applies to all mobile computing devices including, but not limited to, mobile phones, personal digital assistants (PDAs), netbooks, tablet computers, notebook computers, electronic readers, digital music players, digital video players, game consoles, among others.
Several embodiments of the present invention have been described. Nevertheless, it will be understood that various modifications may be made without departing from the spirit and scope of the invention. Accordingly, other embodiments are within the scope of the following claims.

Claims (22)

What is claimed is:
1. A system for a user to enter a secure Personal Identification Number (PIN) into a mobile computing device comprising:
a mobile computing device comprising a mobile application and a display, wherein the mobile application runs on the mobile computing device and displays a mobile computing device grid on the display;
a peripheral device comprising a display and an encryption engine, wherein the peripheral device is separated from the mobile computing device, and wherein the display of the peripheral device displays a peripheral device grid corresponding to the mobile computing device grid displayed on the mobile computing device display,
wherein the peripheral device is connected to the mobile computing device via a data communication link;
wherein the peripheral device grid is generated by the peripheral device and displayed by the display of the peripheral device based on a request received by the peripheral device, the request transmitted by the mobile computing device via the data communication link, the peripheral device grid displaying positional information not displayed on the mobile computing device grid, wherein the positional information displayed on the peripheral device grid enables the user to enter positional inputs on the mobile computing device grid; and
wherein the positional inputs entered on the mobile computing device grid are sent to the peripheral device, and the peripheral device:
decodes the positional inputs into PIN digits;
generates an encrypted PIN; and
sends the encrypted PIN back to the mobile computing device.
2. The system of claim 1, wherein the mobile application displays the mobile computing device grid on the mobile computing device display without showing any digits.
3. The system in claim 1, wherein the peripheral device grid comprises a randomized grid of digits.
4. The system of claim 1, wherein the peripheral device grid randomizes a position of each digit on the peripheral device grid after each positional input.
5. The system in claim 1, wherein the encryption engine in the peripheral device stores one or more cryptographic keys and wherein the one or more cryptographic keys are used to generate the encrypted PIN.
6. The system in claim 1 wherein the encryption engine in the peripheral device performs at least one cryptographic operation.
7. The system in claim 1, wherein the data communication link comprises either a wired or wireless data communication link, wherein:
the wired data communication link comprises one of USB, Firewire, RS232 or audio jack interface, and
the wireless data communication link comprises one of WiFi, Bluetooth, Infrared, or NFC interface.
8. The system in claim 1, wherein the peripheral device comprises one of a magnetic card reader, EMV card reader, NFC reader, keypad, or biometrics readers.
9. The system of claim 1, wherein the mobile computing device comprises one of mobile phones, personal digital assistants (PDAs), netbooks, tablet computers, notebook computers, electronic readers, digital music players, digital video players, or game consoles.
10. The system of claim 1, wherein the positional inputs on the mobile computing device are provided via one of touch screens, mouse clicks, track ball, or eyeball movement tracking devices.
11. A system for a user to securely enter a Personal Identification Number (PIN), comprising:
an application running on a first device having a first device display, wherein the application displays a first device grid for positional input capture on the first device display;
a second device comprising a second device display and an encryption engine, wherein:
the first device is coupled to the second device via a data communication link;
the second device receives a request from the application to generate a second device grid and display the generated second device grid, the request transmitted via the data communication link;
the second device generates the second device grid and the second device display displays the generated second device grid based on the received request, wherein:
the second device grid comprises a representation of a digits grid not displayed on the first device grid; and
the displaying of the representation of the digits grid enables the user to securely enter positional inputs on the first device grid;
the positional inputs entered on the first device grid are captured and transmitted to the second device via the data communication link;
the second device decodes the positional inputs into PIN digits;
the encryption engine generates an encrypted PIN from the decoded PIN digits; and
the second device transmits the encrypted PIN back to the first device.
12. The system of claim 11, wherein the first device is a mobile device.
13. The system of claim 12, wherein the second device is a peripheral device.
14. The system of claim 11, wherein:
the encryption engine performs at least one cryptographic operation; and
the encryption engine stores one or more cryptographic keys, wherein the one or more cryptographic keys are used to generate the encrypted PIN.
15. The system of claim 11, wherein the data communication link comprises either a wired or wireless data communication link, wherein:
the wired data communication link comprises one of USB, Firewire, RS232 or audio jack interface, and
the wireless data communication link comprises one of WiFi, Bluetooth, infrared, or NFC interface.
16. The system of claim 11, wherein the second device comprises one of a magnetic card reader, an EMV card reader, an NFC reader, keypad, or biometrics readers.
17. The system of claim 11, wherein the first device comprises one of mobile phones, personal digital assistants (PDAs), netbooks, tablet computers, notebook computers, electronic readers, digital music players, digital video players, or game consoles.
18. The system of claim 11, wherein the application displays the first device grid on the first device display without showing any digits.
19. The system of claim 11, wherein the second device grid comprises a randomized grid of digits.
20. The system of claim 19, wherein the second device grid randomizes a position of each digit on the second device grid after each positional input.
21. A method for entering a secure Personal Identification Number (PIN), comprising:
providing an application to:
run on a first device comprising a first device display;
display a first device grid on the first device display for positional input capture; and
transmit a request to generate a second device grid over a data communication link;
providing a second device comprising a second device display and an encryption engine to:
receive the request to generate the second device grid from the data communication link;
generate and display the second device grid on the second device display in response to the received request, wherein:
the second device grid comprises a representation of a digits grid, wherein the representation of the digits grid not displayed on the first device grid; and
the displaying of the representation of the digits grid enables a user to securely enter positional inputs on the first device grid;
receive the entered positional inputs captured from the first device grid;
decode the received positional inputs into PIN digits;
generate, using the encryption engine, an encrypted PIN from the decoded PIN digits; and
transmit the encrypted PIN back to the first device.
22. The method of claim 21, wherein the first device is a mobile device and the second device is a peripheral device.
US16/165,226 2012-12-12 2018-10-19 System and method for PIN entry on mobile devices Active US10409976B2 (en)

Priority Applications (3)

Application Number Priority Date Filing Date Title
US16/165,226 US10409976B2 (en) 2012-12-12 2018-10-19 System and method for PIN entry on mobile devices
US16/440,661 US10867027B2 (en) 2012-12-12 2019-06-13 System and method for pin entry on mobile devices
US17/113,683 US11580208B2 (en) 2012-12-12 2020-12-07 System and method for PIN entry on mobile devices

Applications Claiming Priority (3)

Application Number Priority Date Filing Date Title
US201261736116P 2012-12-12 2012-12-12
US14/100,076 US10108796B2 (en) 2012-12-12 2013-12-09 System and method for PIN entry on mobile devices
US16/165,226 US10409976B2 (en) 2012-12-12 2018-10-19 System and method for PIN entry on mobile devices

Related Parent Applications (1)

Application Number Title Priority Date Filing Date
US14/100,076 Continuation US10108796B2 (en) 2012-12-12 2013-12-09 System and method for PIN entry on mobile devices

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/440,661 Continuation US10867027B2 (en) 2012-12-12 2019-06-13 System and method for pin entry on mobile devices

Publications (2)

Publication Number Publication Date
US20190050553A1 US20190050553A1 (en) 2019-02-14
US10409976B2 true US10409976B2 (en) 2019-09-10

Family

ID=50882354

Family Applications (4)

Application Number Title Priority Date Filing Date
US14/100,076 Active 2034-03-02 US10108796B2 (en) 2012-12-12 2013-12-09 System and method for PIN entry on mobile devices
US16/165,226 Active US10409976B2 (en) 2012-12-12 2018-10-19 System and method for PIN entry on mobile devices
US16/440,661 Active US10867027B2 (en) 2012-12-12 2019-06-13 System and method for pin entry on mobile devices
US17/113,683 Active 2034-01-12 US11580208B2 (en) 2012-12-12 2020-12-07 System and method for PIN entry on mobile devices

Family Applications Before (1)

Application Number Title Priority Date Filing Date
US14/100,076 Active 2034-03-02 US10108796B2 (en) 2012-12-12 2013-12-09 System and method for PIN entry on mobile devices

Family Applications After (2)

Application Number Title Priority Date Filing Date
US16/440,661 Active US10867027B2 (en) 2012-12-12 2019-06-13 System and method for pin entry on mobile devices
US17/113,683 Active 2034-01-12 US11580208B2 (en) 2012-12-12 2020-12-07 System and method for PIN entry on mobile devices

Country Status (3)

Country Link
US (4) US10108796B2 (en)
CN (2) CN109033771B (en)
WO (1) WO2014090175A1 (en)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10867027B2 (en) * 2012-12-12 2020-12-15 BBPOS Limited System and method for pin entry on mobile devices

Families Citing this family (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
GB201212878D0 (en) 2012-07-20 2012-09-05 Pike Justin Authentication method and system
US9264228B2 (en) * 2013-02-14 2016-02-16 BBPOS Limited System and method for a secure display module
US10049197B2 (en) * 2014-07-14 2018-08-14 Knuedge Incorporated System and methods for personal identification number authentication and verification
US10296733B2 (en) * 2014-07-14 2019-05-21 Friday Harbor Llc Access code obfuscation using speech input
FR3026207B1 (en) * 2014-09-22 2018-08-17 Prove & Run SECURE DISPLAY TERMINAL
GB201520741D0 (en) * 2015-05-27 2016-01-06 Mypinpad Ltd And Licentia Group Ltd Authentication methods and systems
GB201916441D0 (en) 2019-11-12 2019-12-25 Mypinpad Ltd Computer-implemented system and method
CN110867018B (en) * 2019-11-28 2020-11-27 福建新大陆支付技术有限公司 System and method for realizing safe PIN input on cash register with Android intelligent platform

Citations (14)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20060053301A1 (en) 2002-12-23 2006-03-09 Hwa-Shik Shin Device and method for inputting password using random keypad
US20070174615A1 (en) 2005-04-11 2007-07-26 Lastmile Communications Limited Method and device for communication using random codes
CN201035502Y (en) 2006-12-28 2008-03-12 上海麦柯信息技术有限公司 Safety accidental dynamic soft keyboard
US20100138666A1 (en) * 2008-12-01 2010-06-03 Neil Patrick Adams Simplified multi-factor authentication
US20120047564A1 (en) 2009-05-15 2012-02-23 Setcom (Pty) Ltd. Security system and method
US20120104090A1 (en) 2010-10-29 2012-05-03 International Business Machines Corporation Card-reader apparatus
US20120268393A1 (en) 2011-04-25 2012-10-25 SoftLayer Technologies,Inc. System and Method for Secure Data Entry
US20120280923A1 (en) 2011-04-08 2012-11-08 Paul Vincent System for protecting pin data when using touch capacitive touch technology on a point-of-sale terminal or an encrypting pin pad device
US20130086389A1 (en) 2011-09-30 2013-04-04 Nx B.V. Security Token and Authentication System
US20130127725A1 (en) 2011-11-18 2013-05-23 Konica Minolta Business Technologies, Inc. Operation input system and operation input method
US20130223279A1 (en) * 2012-02-24 2013-08-29 Peerapol Tinnakornsrisuphap Sensor based configuration and control of network devices
US20130328801A1 (en) * 2012-06-12 2013-12-12 Square, Inc. Software pin entry
US20140324708A1 (en) 2012-06-12 2014-10-30 Square, Inc. Raw sensor input encryption for passcode entry security
US20140365782A1 (en) * 2004-06-14 2014-12-11 Rodney Beatson Method and System for Providing Password-free, Hardware-rooted, ASIC-based Authentication of a Human to a Mobile Device using Biometrics with a Protected, Local Template to Release Trusted Credentials to Relying Parties

Family Cites Families (14)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7333602B2 (en) * 2000-01-13 2008-02-19 Tomohiro Habu Information entry system
GB0504545D0 (en) * 2005-03-07 2005-04-13 Tricerion Ltd A method of secure data communication
CA2648523C (en) * 2005-04-21 2018-09-04 Securedpay Solutions, Inc. Portable handheld device for wireless order entry and real time payment authorization and related methods
CN101290647A (en) * 2007-04-19 2008-10-22 鸿富锦精密工业（深圳）有限公司 Password protection device and method and password keyboard
US10614462B2 (en) * 2007-09-26 2020-04-07 Clevx, Llc Security aspects of a self-authenticating credit card
KR20090099750A (en) * 2008-03-18 2009-09-23 주식회사 두올테크 Resource Integrated Management Device
DE102009011217A1 (en) * 2009-03-04 2010-09-09 Siemens Aktiengesellschaft Control of the extended dryer section of a paper machine
CN101695066B (en) * 2009-09-28 2012-12-19 北京深思洛克软件技术股份有限公司 Security authentication method and information security authentication equipment
CN101695107B (en) * 2009-10-09 2012-07-25 北京数码视讯科技股份有限公司 Method of soft keyboard for safely inputting code of set top box of digital television
US8251286B2 (en) * 2009-11-24 2012-08-28 Magtek, Inc. System and method for conducting secure PIN debit transactions
US8605044B2 (en) * 2010-02-12 2013-12-10 Maxim Integrated Products, Inc. Trusted display based on display device emulation
CN202150070U (en) * 2010-12-14 2012-02-22 深圳市中成汇实业有限公司 Personal on-line transaction terminal
US8621235B2 (en) * 2011-01-06 2013-12-31 Verifone, Inc. Secure pin entry device
US10108796B2 (en) * 2012-12-12 2018-10-23 BBPOS Limited System and method for PIN entry on mobile devices

Patent Citations (16)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20060053301A1 (en) 2002-12-23 2006-03-09 Hwa-Shik Shin Device and method for inputting password using random keypad
US20140365782A1 (en) * 2004-06-14 2014-12-11 Rodney Beatson Method and System for Providing Password-free, Hardware-rooted, ASIC-based Authentication of a Human to a Mobile Device using Biometrics with a Protected, Local Template to Release Trusted Credentials to Relying Parties
US20070174615A1 (en) 2005-04-11 2007-07-26 Lastmile Communications Limited Method and device for communication using random codes
CN201035502Y (en) 2006-12-28 2008-03-12 上海麦柯信息技术有限公司 Safety accidental dynamic soft keyboard
US20100138666A1 (en) * 2008-12-01 2010-06-03 Neil Patrick Adams Simplified multi-factor authentication
US20120047564A1 (en) 2009-05-15 2012-02-23 Setcom (Pty) Ltd. Security system and method
CN102422302A (en) 2009-05-15 2012-04-18 赛特康姆有限公司 Security system and method
US20120104090A1 (en) 2010-10-29 2012-05-03 International Business Machines Corporation Card-reader apparatus
US20120280923A1 (en) 2011-04-08 2012-11-08 Paul Vincent System for protecting pin data when using touch capacitive touch technology on a point-of-sale terminal or an encrypting pin pad device
US20120268393A1 (en) 2011-04-25 2012-10-25 SoftLayer Technologies,Inc. System and Method for Secure Data Entry
US20130086389A1 (en) 2011-09-30 2013-04-04 Nx B.V. Security Token and Authentication System
US20130127725A1 (en) 2011-11-18 2013-05-23 Konica Minolta Business Technologies, Inc. Operation input system and operation input method
US20130223279A1 (en) * 2012-02-24 2013-08-29 Peerapol Tinnakornsrisuphap Sensor based configuration and control of network devices
US20130328801A1 (en) * 2012-06-12 2013-12-12 Square, Inc. Software pin entry
US20130333011A1 (en) 2012-06-12 2013-12-12 Square, Inc. Software pin entry
US20140324708A1 (en) 2012-06-12 2014-10-30 Square, Inc. Raw sensor input encryption for passcode entry security

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
Communication from a foreign patent office in a counterpart foreign application, The State Intellectual Proerpty Office of People's Republic of China, "First Office Action," Chinese Application No. 201380065058.8, dated May 18, 2017, 9 pages.

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10867027B2 (en) * 2012-12-12 2020-12-15 BBPOS Limited System and method for pin entry on mobile devices
US11580208B2 (en) * 2012-12-12 2023-02-14 Stripe, Inc. System and method for PIN entry on mobile devices

Also Published As

Publication number Publication date
US20190311106A1 (en) 2019-10-10
CN109033771B (en) 2020-09-08
US20210117531A1 (en) 2021-04-22
CN104871166A (en) 2015-08-26
US10867027B2 (en) 2020-12-15
CN109033771A (en) 2018-12-18
CN104871166B (en) 2018-08-07
US20190050553A1 (en) 2019-02-14
US20140164782A1 (en) 2014-06-12
US11580208B2 (en) 2023-02-14
WO2014090175A1 (en) 2014-06-19
US10108796B2 (en) 2018-10-23

Similar Documents

Publication Publication Date Title
US11580208B2 (en) System and method for PIN entry on mobile devices
CN103793815B (en) Mobile intelligent terminal acquirer system and method suitable for bank cards and business cards
JP6887956B2 (en) Secure biometric data capture, processing and management
US20190260747A1 (en) Securing a transaction performed from a non-secure terminal
JP2021106059A (en) Authentication method and authentication system
US11171968B1 (en) Method and system for user credential security
KR20150098002A (en) Authentication method and apparatus based on biometric information in a electronic device
CN108475376A (en) The system and method for certification user in equipment
US10147090B2 (en) Validating a transaction with a secure input without requiring pin code entry
CN107516215B (en) Intelligent POS terminal and method capable of safely inputting PIN code
CN107422838A (en) A kind of Wearable, solution lock control system and solution lock control method
CN204069000U (en) Mobile encrypted authenticate device
CN104636917A (en) Mobile payment system and method with secure payment function
Guerar et al. Color wheel pin: Usable and resilient ATM authentication
US20150288684A1 (en) Device assembly for carrying out or enabling an electronic service and a method for securely inputting authorization data
CN103984913A (en) Device with fingerprint induction identification and method thereof
CN110555702B (en) Device and method for secure identification of a user
US10845990B2 (en) Method for executing of security keyboard, apparatus and system for executing the method
KR20160008012A (en) User authentification method in mobile terminal
JP2015171104A (en) Information processing device and information processing method
CN103619015A (en) Method, device and system for using mobile terminal to carry out information verification
KR101648779B1 (en) Method for secure text input in information terminal
CN104715171B (en) Mobile device, terminal device and verification method thereof
TWI527393B (en) Authentication device of short-range wireless communication and method thereof
CN116828461A (en) Terminal device message output method, device and storage medium

Legal Events

Date Code Title Description
AS Assignment

Owner name: BBPOS LIMITED, HONG KONG

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:LO, CHI WAH;REEL/FRAME:047234/0774

Effective date: 20180531

FEPP Fee payment procedure

Free format text: ENTITY STATUS SET TO UNDISCOUNTED (ORIGINAL EVENT CODE: BIG.); ENTITY STATUS OF PATENT OWNER: SMALL ENTITY

FEPP Fee payment procedure

Free format text: ENTITY STATUS SET TO SMALL (ORIGINAL EVENT CODE: SMAL); ENTITY STATUS OF PATENT OWNER: SMALL ENTITY

STPP Information on status: patent application and granting procedure in general

Free format text: NON FINAL ACTION MAILED

STPP Information on status: patent application and granting procedure in general

Free format text: NOTICE OF ALLOWANCE MAILED -- APPLICATION RECEIVED IN OFFICE OF PUBLICATIONS

STPP Information on status: patent application and granting procedure in general

Free format text: AWAITING TC RESP., ISSUE FEE NOT PAID

STPP Information on status: patent application and granting procedure in general

Free format text: PUBLICATIONS -- ISSUE FEE PAYMENT RECEIVED

STPP Information on status: patent application and granting procedure in general

Free format text: PUBLICATIONS -- ISSUE FEE PAYMENT VERIFIED

STCF Information on status: patent grant

Free format text: PATENTED CASE

AS Assignment

Owner name: STRIPE, INC., CALIFORNIA

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:BBPOS LIMITED;REEL/FRAME:061790/0031

Effective date: 20221026

Owner name: STRIPE, INC., CALIFORNIA

Free format text: ASSIGNMENT OF ASSIGNOR'S INTEREST;ASSIGNOR:BBPOS LIMITED;REEL/FRAME:061790/0031

Effective date: 20221026

FEPP Fee payment procedure

Free format text: ENTITY STATUS SET TO UNDISCOUNTED (ORIGINAL EVENT CODE: BIG.); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY

FEPP Fee payment procedure

Free format text: SURCHARGE FOR LATE PAYMENT, LARGE ENTITY (ORIGINAL EVENT CODE: M1554); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY

MAFP Maintenance fee payment

Free format text: PAYMENT OF MAINTENANCE FEE, 4TH YEAR, LARGE ENTITY (ORIGINAL EVENT CODE: M1551); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY

Year of fee payment: 4